Glossary
Model Context Protocol (MCP)
An open protocol that connects AI assistants to tools and data sources, such as databases, code hosts and APIs, through a standard interface.
Also called MCP server.
In plain terms
MCP lets an assistant like Claude, Cursor or Copilot call tools on your behalf: query a database, read issues, open pull requests. That’s what makes agents useful, and it’s also what makes their mistakes consequential.
Security comes down to scope. An MCP connection inherits the permissions of the credentials behind it, so an assistant reading untrusted text with a powerful connection is a prompt-injection target.
See what happens without it
The failure pattern this protects against, indirect prompt injection changes agent behavior, played out step by step.
Scroll the diagram sideways to see every system.
It posts the secrets where the attacker can read them.
What goes wrong:
- An attacker hides instructions inside an ordinary support ticket.
- A developer asks the assistant to summarise new tickets.
- The assistant obeys the ticket and reads the private tables.
- It posts the secrets where the attacker can read them.
With the safeguard:
- An attacker hides instructions inside an ordinary support ticket.
- The ticket text reaches the assistant as data to summarise, never as orders.
- Its tools cannot reach private tables, so the injected request is refused.
- Nothing leaves, and the ticket is flagged for review.
When it mattered
In 2025 researchers showed that instructions hidden in a support ticket could make a developer’s MCP-connected assistant read a private table of integration tokens.